CVE-2026-28279

Estado: AnalizadaAlta (8.4)—

osctrl is an osquery management solution. Prior to version 0.5.0, an OS command injection vulnerability exists in the `osctrl-admin` environment configuration. An authenticated administrator can inject arbitrary shell commands via the hostname parameter when creating or editing environments. These commands are embedded into enrollment one-liner scripts generated using Go's `text/template` package (which does not perform shell escaping) and execute on every endpoint that enrolls using the compromised environment.

Leer descripción completaMostrar menos

An attacker with administrator access can achieve remote code execution on every endpoint that enrolls using the compromised environment. Commands execute as root/SYSTEM (the privilege level used for osquery enrollment) before osquery is installed, leaving no agent-level audit trail. This enables backdoor installation, credential exfiltration, and full endpoint compromise. This is fixed in osctrl `v0.5.0`. As a workaround, restrict osctrl administrator access to trusted personnel, review existing environment configurations for suspicious hostnames, and/or monitor enrollment scripts for unexpected commands.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Puntuación base: 8.4

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.28%
Percentil entre todas las CVEs puntuadas: 69
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement85 %
Impacto principalT1059 Command and Scripting Interpreterexecution95 %
Impacto secundarioT1078 Valid Accountsstealth · persistence · privilege escalation · initial access70 %
Impacto secundarioT1098 Account Manipulationpersistence · privilege escalation65 %

Acceso remoto a red adyacente (AV:A, PR:H) permite inyección de comandos en scripts de inscripción que se ejecutan como root/SYSTEM en endpoints remotos, logrando ejecución de código y manipulación de cuentas administrativas.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Disable or Remove Feature or Program User Account Management Network Segmentation Multi-factor Authentication Application Developer Guidance

Tecnologías afectadas (1)

Jmpsec — Osctrl

CWE

CWE-78

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-28279",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-28279",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-27T17:33:31.500697Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 0.7
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.4,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "jmpsec",
          "product": "osctrl",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.5.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-26T23:16:37.567",
  "references": [
    {
      "url": "https://github.com/jmpsec/osctrl/pull/777",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/jmpsec/osctrl/pull/780",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/jmpsec/osctrl/security/advisories/GHSA-rchw-322g-f7rm",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "osctrl is an osquery management solution. Prior to version 0.5.0, an OS command injection vulnerability exists in the `osctrl-admin` environment configuration. An authenticated administrator can inject arbitrary shell commands via the hostname parameter when creating or editing environments. These commands are embedded into enrollment one-liner scripts generated using Go's `text/template` package (which does not perform shell escaping) and execute on every endpoint that enrolls using the compromised environment. An attacker with administrator access can achieve remote code execution on every endpoint that enrolls using the compromised environment. Commands execute as root/SYSTEM (the privilege level used for osquery enrollment) before osquery is installed, leaving no agent-level audit trail. This enables backdoor installation, credential exfiltration, and full endpoint compromise. This is fixed in osctrl `v0.5.0`. As a workaround, restrict osctrl administrator access to trusted personnel, review existing environment configurations for suspicious hostnames, and/or monitor enrollment scripts for unexpected commands."
    },
    {
      "lang": "es",
      "value": "osctrl es una solución de gestión de osquery. Antes de la versión 0.5.0, existe una vulnerabilidad de inyección de comandos del sistema operativo en la configuración del entorno de `osctrl-admin`. Un administrador autenticado puede inyectar comandos de shell arbitrarios a través del parámetro de nombre de host al crear o editar entornos. Estos comandos se incrustan en scripts de una sola línea de inscripción generados usando el paquete `text/template` de Go (que no realiza el escape de shell) y se ejecutan en cada punto final que se inscribe usando el entorno comprometido. Un atacante con acceso de administrador puede lograr la ejecución remota de código en cada punto final que se inscribe usando el entorno comprometido. Los comandos se ejecutan como root/SYSTEM (el nivel de privilegio utilizado para la inscripción de osquery) antes de que se instale osquery, sin dejar rastro de auditoría a nivel de agente. Esto permite la instalación de puertas traseras, la exfiltración de credenciales y el compromiso total del punto final. Esto se corrige en osctrl `v0.5.0`. Como solución alternativa, restrinja el acceso de administrador de osctrl a personal de confianza, revise las configuraciones de entorno existentes en busca de nombres de host sospechosos y/o monitoree los scripts de inscripción en busca de comandos inesperados."
    }
  ],
  "lastModified": "2026-06-17T10:28:25.273",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jmpsec:osctrl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CCE1BE74-A736-44A6-ABC7-D1D48E7A0EA5",
              "versionEndExcluding": "0.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}